NSE NSE Cloud Security & Virtualization 2

Question 1

What does the term 'Infrastructure as Code' (IaC) security mean in cloud environments?

Accepted Answer

Scanning and securing infrastructure definition files (e.g., Terraform, CloudFormation) for misconfigurations before deployment

Answer

IaC security involves analyzing infrastructure templates for security misconfigurations, hardcoding of secrets, and policy violations before they are deployed to the cloud.

Question 2

Which type of cloud storage misconfiguration has been responsible for many high-profile US data breaches?

Accepted Answer

Publicly accessible storage buckets (e.g., open S3 buckets) without authentication requirements

Answer

Misconfigured public cloud storage buckets have exposed millions of records by allowing unauthenticated internet access to sensitive data files.

Question 3

What is the security advantage of using ephemeral credentials in cloud environments compared to long-lived static API keys?

Accepted Answer

Ephemeral credentials expire quickly, limiting the window of opportunity if they are compromised

Answer

Short-lived credentials minimize the blast radius of credential theft because they expire after minutes or hours, rendering stolen tokens useless quickly.

Question 4

In cloud security, what is the purpose of a Security Group compared to a Network Access Control List (NACL)?

Accepted Answer

Security groups are stateful and apply to instances; NACLs are stateless and apply to subnets

Answer

Security groups are stateful instance-level firewalls that automatically allow return traffic, while NACLs are stateless subnet-level filters requiring explicit inbound and outbound rules.

Question 5

Which cloud security principle recommends distributing workloads across multiple availability zones?

Accepted Answer

High availability and resilience

Answer

Deploying across multiple availability zones ensures that a failure in one physical data center location does not render the entire application unavailable.

(NSE) Network Security Expert Practice Test

(NSE) Network Security Expert Practice Test

NSE NSE Cloud Security & Virtualization 2